Probleme virus "ADVANCED VIRUS REMOVED"

caledolove -  
Bonjour,
j'ai depuis deux jours une fenêtre vitrus avec Advance Virus Remover d'écrit. comment m'en débarrassser.
j'ai déja ASHAMPOO ANTISPYWAR 2 GUARD, AD AWARE ET NORTON INTERNET SECURITE? mais rien ne fais je n'arrive toujours pas à la supprimer. Merci pour votre aide.
Configuration: Windows XP Internet Explorer 7.0

22 réponses

Résumé de la discussion

La question porte sur la suppression d'Advance Virus Remover qui s'affiche sur Windows XP avec Internet Explorer 7 et résiste aux outils antivirus usuels. Des propositions d'intervention incluent GenProc pour l'analyse et ComboFix pour un nettoyage en profondeur, avec publication des rapports générés par l'utilisateur. D'autres manipulations conseillent de supprimer C:\WINDOWS\System32\Tqpr4.vbs et de relancer GenProc, et de prendre en compte une éventuelle correction IE8 dans le processus. Des retours indiquent que la fenêtre Advanced Virus Remover a disparu après ces manipulations, sans confirmation certaine de l'élimination complète.

Bobot (l’IA à votre service)
  1. Narco!4 Contributeur
    Bonjour,

    télécharge GenProc http://www.genproc.com/GenProc.exe

    double-clique sur GenProc.exe et poste le contenu du rapport qui s'ouvre
    0
    1. caledolove
      ok merci
      0
    2. caledolove
      il me dit de patienter pendant 30secondes à 1minutes 30 , mais là ca fais 5 minutes et toujours rien c'est normal ?
      0
  2. caledolove
    petite erreur de configuration : Internet explorer 8 et non Internet explorer 7
    0
    1. Narco!4 Contributeur
      oui, attend
      0
      1. caledolove
        ok,
        là j'ai eu une fenêtre hitjack qui c'est ouverte en me demandant accepter ce que j'ai fais c'est normal
        0
    2. Narco!4 Contributeur
      oui
      0
      1. caledolove
        voilà !!

        Rapport GenProc 2.627 [1] - 15/09/2009 à 12:47:43
        @ Windows XP Service Pack 3 - Mode normal
        @ Internet Explorer (8.0.6001.18702) [Navigateur par défaut]

        GenProc n'a détecté aucune infection caractéristique et suggère de suivre la procédure suivante :

        Fais scanner le(s) fichier(s) suivant(s) sur ce site https://www.virustotal.com/gui/ :

        C:\WINDOWS\System32\Tqpr4.vbs

        et poste le(s) rapport(s) obtenu(s) dans ta prochaine réponse.

        ~~~~ INFORMATION COMPLEMENTAIRE ~~~~

        Logfile of Trend Micro HijackThis v2.0.2
        Scan saved at 12:57:40, on 15/09/2009
        Platform: Windows XP SP3 (WinNT 5.01.2600)
        MSIE: Internet Explorer v8.00 (8.00.6001.18702)
        Boot mode: Normal

        Running processes:
        C:\WINDOWS\System32\smss.exe
        C:\WINDOWS\system32\csrss.exe
        C:\WINDOWS\system32\winlogon.exe
        C:\WINDOWS\system32\services.exe
        C:\WINDOWS\system32\lsass.exe
        C:\WINDOWS\system32\svchost.exe
        C:\WINDOWS\system32\svchost.exe
        C:\Program Files\Windows Defender\MsMpEng.exe
        C:\WINDOWS\System32\svchost.exe
        C:\WINDOWS\system32\svchost.exe
        C:\WINDOWS\system32\svchost.exe
        C:\Program Files\Lavasoft\Ad-Aware\AAWService.exe
        C:\WINDOWS\system32\spoolsv.exe
        C:\WINDOWS\system32\svchost.exe
        C:\Program Files\Ashampoo\Ashampoo AntiSpyWare 2\AntiSpyWareService.exe
        C:\Program Files\Microsoft Small Business\Business Contact Manager\BcmSqlStartupSvc.exe
        C:\WINDOWS\Explorer.EXE
        C:\Program Files\Bonjour\mDNSResponder.exe
        C:\Program Files\Java\jre6\bin\jqs.exe
        C:\Program Files\Fichiers communs\Nero\Nero BackItUp 4\NBService.exe
        C:\Program Files\Norton Internet Security\Engine\16.7.2.11\ccSvcHst.exe
        C:\WINDOWS\system32\nvsvc32.exe
        C:\Program Files\Microsoft SQL Server\90\Shared\sqlbrowser.exe
        C:\Program Files\Microsoft SQL Server\90\Shared\sqlwriter.exe
        C:\WINDOWS\system32\svchost.exe
        C:\WINDOWS\system32\DRIVERS\WtSrv.exe
        C:\Program Files\Norton Internet Security\Engine\16.7.2.11\ccSvcHst.exe
        C:\WINDOWS\system32\wbem\wmiapsrv.exe
        C:\WINDOWS\system32\wbem\unsecapp.exe
        C:\WINDOWS\System32\alg.exe
        C:\WINDOWS\system32\wbem\wmiprvse.exe
        C:\WINDOWS\RTHDCPL.EXE
        C:\WINDOWS\system32\RUNDLL32.EXE
        C:\Program Files\Adobe\Acrobat 8.0\Acrobat\Acrotray.exe
        C:\Program Files\NOBRAND\802.11g Wireless USB Adapter\PRISMSVR.EXE
        C:\WINDOWS\system32\WService.EXE
        C:\Program Files\Fichiers communs\Real\Update_OB\realsched.exe
        C:\Program Files\Java\jre6\bin\jusched.exe
        C:\Program Files\Ashampoo\Ashampoo AntiSpyWare 2\AntiSpyWare2Guard.exe
        C:\Program Files\Lavasoft\Ad-Aware\AAWTray.exe
        C:\Program Files\Windows Defender\MSASCui.exe
        C:\WINDOWS\system32\ctfmon.exe
        C:\Program Files\NOBRAND\802.11g Wireless USB Adapter\NB11GUTI.exe
        C:\Program Files\Fichiers communs\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe
        C:\Program Files\Internet Explorer\iexplore.exe
        C:\Program Files\Internet Explorer\iexplore.exe
        C:\WINDOWS\system32\rundll32.exe
        C:\Program Files\Windows Live\Messenger\msnmsgr.exe
        C:\WINDOWS\system32\cmd.exe
        C:\Program Files\Internet Explorer\iexplore.exe
        C:\GenProc\outil\Franck_GenProc.exe
        C:\WINDOWS\system32\wbem\wmiprvse.exe

        R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://www.ldlc.com/
        R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
        R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://outlook.live.com/owa/
        R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://www.msn.com/fr-fr/?ocid=iehp
        R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
        R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
        R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.msn.com/fr-fr/?ocid=iehp
        R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Windows Internet Explorer [Fourni Par LDLC.com]
        R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
        R3 - URLSearchHook: Yahoo! Toolbar avec bloqueur de fenêtres pop-up - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - (no file)
        O2 - BHO: Aide pour le lien d'Adobe PDF Reader - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Fichiers communs\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
        O2 - BHO: Skype add-on (mastermind) - {22BF413B-C6D2-4d91-82A9-A0F997BA588C} - C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll
        O2 - BHO: RealPlayer Download and Record Plugin for Internet Explorer - {3049C3E9-B461-4BC5-8870-4C09146192CA} - C:\Program Files\Real\RealPlayer\rpbrowserrecordplugin.dll
        O2 - BHO: (no name) - {5C255C8A-E604-49b4-9D64-90988571CECB} - (no file)
        O2 - BHO: Symantec NCO BHO - {602ADB0E-4AFF-4217-8AA1-95DAC4DFA408} - C:\Program Files\Norton Internet Security\Engine\16.7.2.11\coIEPlg.dll
        O2 - BHO: Symantec Intrusion Prevention - {6D53EC84-6AAE-4787-AEEE-F4628F01010C} - C:\Program Files\Norton Internet Security\Engine\16.7.2.11\IPSBHO.DLL
        O2 - BHO: Programme d'aide de l'Assistant de connexion Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
        O2 - BHO: Adobe PDF Conversion Toolbar Helper - {AE7CD045-E861-484f-8273-0445EE161910} - C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll
        O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
        O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
        O3 - Toolbar: Adobe PDF - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll
        O3 - Toolbar: Norton Toolbar - {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} - C:\Program Files\Norton Internet Security\Engine\16.7.2.11\coIEPlg.dll
        O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE
        O4 - HKLM\..\Run: [Alcmtr] ALCMTR.EXE
        O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
        O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
        O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
        O4 - HKLM\..\Run: [Acrobat Assistant 8.0] "C:\Program Files\Adobe\Acrobat 8.0\Acrobat\Acrotray.exe"
        O4 - HKLM\..\Run: [Adobe_ID0EYTHM] C:\PROGRA~1\FICHIE~1\Adobe\ADOBEV~1\Server\bin\VERSIO~2.EXE
        O4 - HKLM\..\Run: [WService] WService.EXE
        O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
        O4 - HKLM\..\Run: [PRISMSVR.EXE] "C:\Program Files\NOBRAND\802.11g Wireless USB Adapter\PRISMSVR.EXE" /APPLY
        O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Fichiers communs\Real\Update_OB\realsched.exe" -osboot
        O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe"
        O4 - HKLM\..\Run: ['Ashampoo AntiSpyWare 2 Guard'] C:\Program Files\Ashampoo\Ashampoo AntiSpyWare 2\AntiSpyWare2Guard.exe
        O4 - HKLM\..\Run: [Ad-Watch] C:\Program Files\Lavasoft\Ad-Aware\AAWTray.exe
        O4 - HKLM\..\Run: [Windows Defender] "C:\Program Files\Windows Defender\MSASCui.exe" -hide
        O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
        O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE LOCAL')
        O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE RÉSEAU')
        O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
        O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
        O4 - Global Startup: 802.11g Wireless USB Adapter Utility.lnk = C:\Program Files\NOBRAND\802.11g Wireless USB Adapter\NB11GUTI.exe
        O8 - Extra context menu item: Ajouter au fichier PDF existant - res://C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
        O8 - Extra context menu item: Convertir en Adobe PDF - res://C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
        O8 - Extra context menu item: Convertir la cible du lien en Adobe PDF - res://C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
        O8 - Extra context menu item: Convertir la cible du lien en un fichier PDF existant - res://C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
        O8 - Extra context menu item: Convertir la sélection en Adobe PDF - res://C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
        O8 - Extra context menu item: Convertir la sélection en un fichier PDF existant - res://C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
        O8 - Extra context menu item: Convertir les liens sélectionnés en fichier Adobe PDF - res://C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIECaptureSelLinks.html
        O8 - Extra context menu item: Convertir les liens sélectionnés en un fichier PDF existant - res://C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIEAppendSelLinks.html
        O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~3\Office12\EXCEL.EXE/3000
        O9 - Extra button: Skype - {77BF5300-1474-4EC7-9980-D32B190E9B07} - C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll
        O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~3\Office12\REFIEBAR.DLL
        O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
        O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
        O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
        O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
        O16 - DPF: {084DAC27-6FA3-4F55-9005-033F2F102F5C} (ITPPDiagIE Class) - http://data.jeuxclassiques.com/npwwg.cab
        O16 - DPF: {0CCA191D-13A6-4E29-B746-314DEE697D83} (Facebook Photo Uploader 5 Control) - http://upload.facebook.com/controls/2008.10.10_v5.5.8/FacebookPhotoUploader5.cab
        O16 - DPF: {6A344D34-5231-452A-8A57-D064AC9B7862} (Symantec Download Manager) - https://webdl.symantec.com/activex/symdlmgr.cab
        O16 - DPF: {8100D56A-5661-482C-BEE8-AFECE305D968} (Facebook Photo Uploader 5 Control) - http://upload.facebook.com/controls/2009.07.28_v5.5.8.1/FacebookPhotoUploader55.cab
        O17 - HKLM\System\CCS\Services\Tcpip\..\{04705497-0624-4D07-94E9-927BEF887EF9}: NameServer = 212.217.0.1,212.217.0.12
        O17 - HKLM\System\CS1\Services\Tcpip\..\{04705497-0624-4D07-94E9-927BEF887EF9}: NameServer = 212.217.0.1,212.217.0.12
        O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\FICHIE~1\Skype\SKYPE4~1.DLL
        O18 - Protocol: symres - {AA1061FE-6C41-421F-9344-69640C9732AB} - C:\Program Files\Norton Internet Security\Engine\16.7.2.11\coIEPlg.dll
        O20 - AppInit_DLLs: C:\WINDOWS\System32\ds16gt32.dll
        O20 - Winlogon Notify: d444d054669 - C:\WINDOWS\System32\ds16gt32.dll
        O23 - Service: Ashampoo AntiSpyWare 2 Service (AASW2_Service) - Unknown owner - C:\Program Files\Ashampoo\Ashampoo AntiSpyWare 2\AntiSpyWareService.exe
        O23 - Service: Adobe Version Cue CS3 {fr_FR} (Adobe Version Cue CS3) - Adobe Systems Incorporated - C:\Program Files\Fichiers communs\Adobe\Adobe Version Cue CS3\Server\bin\VersionCueCS3.exe
        O23 - Service: ##Id_String1.6844F930_1628_4223_B5CC_5BB94B879762## (Bonjour Service) - Apple Computer, Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
        O23 - Service: FLEXnet Licensing Service - Macrovision Europe Ltd. - C:\Program Files\Fichiers communs\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe
        O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Fichiers communs\InstallShield\Driver\11\Intel 32\IDriverT.exe
        O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe
        O23 - Service: Lavasoft Ad-Aware Service - Lavasoft - C:\Program Files\Lavasoft\Ad-Aware\AAWService.exe
        O23 - Service: Nero BackItUp Scheduler 4.0 - Nero AG - C:\Program Files\Fichiers communs\Nero\Nero BackItUp 4\NBService.exe
        O23 - Service: Norton Internet Security - Symantec Corporation - C:\Program Files\Norton Internet Security\Engine\16.7.2.11\ccSvcHst.exe
        O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
        O23 - Service: Planificateur LiveUpdate automatique - Unknown owner - C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe (file missing)
        O23 - Service: WinTab Service (WinTabService) - Tablet Driver - C:\WINDOWS\system32\DRIVERS\WtSrv.exe
        0
    4. Narco!4 Contributeur
      Fais scanner le(s) fichier(s) suivant(s) sur ce site https://www.virustotal.com/gui/ :

      C:\WINDOWS\System32\Tqpr4.vbs

      et poste le(s) rapport(s) obtenu(s) dans ta prochaine réponse.
      0
      1. caledolove
        Antivirus Version Dernière mise à jour Résultat
        a-squared 4.5.0.24 2009.09.11 Trojan.Script!IK
        AhnLab-V3 5.0.0.2 2009.09.11 VBS/Xema
        AntiVir 7.9.1.14 2009.09.11 SPR/FWBypass.B
        Antiy-AVL 2.0.3.7 2009.09.11 -
        Authentium 5.1.2.4 2009.09.11 -
        Avast 4.8.1351.0 2009.09.11 -
        AVG 8.5.0.412 2009.09.11 -
        BitDefender 7.2 2009.09.11 Trojan.Script.54735
        CAT-QuickHeal 10.00 2009.09.11 -
        ClamAV 0.94.1 2009.09.11 -
        Comodo 2285 2009.09.11 -
        DrWeb 5.0.0.12182 2009.09.11 -
        eSafe 7.0.17.0 2009.09.10 -
        eTrust-Vet 31.6.6733 2009.09.11 -
        F-Prot 4.5.1.85 2009.09.11 -
        F-Secure 8.0.14470.0 2009.09.11 -
        Fortinet 3.120.0.0 2009.09.11 -
        GData 19 2009.09.11 Trojan.Script.54735
        Ikarus T3.1.1.72.0 2009.09.11 Trojan.Script
        Jiangmin 11.0.800 2009.09.11 -
        K7AntiVirus 7.10.842 2009.09.11 -
        Kaspersky 7.0.0.125 2009.09.12 -
        McAfee 5738 2009.09.11 -
        McAfee+Artemis 5738 2009.09.11 -
        McAfee-GW-Edition 6.8.5 2009.09.11 Riskware.FWBypass.B
        Microsoft 1.5005 2009.09.11 -
        NOD32 4417 2009.09.11 VBS/Disabler.NAB
        Norman 6.01.09 2009.09.11 VBS/Smalltroj.XSV
        nProtect 2009.1.8.0 2009.09.11 -
        Panda 10.0.2.2 2009.09.11 VBS/Disabler.E
        PCTools 4.4.2.0 2009.09.11 -
        Prevx 3.0 2009.09.12 -
        Rising 21.46.44.00 2009.09.11 -
        Sophos 4.45.0 2009.09.11 Troj/Fwdisab-B
        Sunbelt 3.2.1858.2 2009.09.11 -
        Symantec 1.4.4.12 2009.09.11 -
        TheHacker 6.3.4.4.400 2009.09.10 -
        TrendMicro 8.950.0.1094 2009.09.11 -
        VBA32 3.12.10.10 2009.09.11 -
        ViRobot 2009.9.11.1930 2009.09.11 -
        VirusBuster 4.6.5.0 2009.09.11 -
        Information additionnelle
        File size: 615 bytes
        MD5 : 768466ea2059580a84f9c0e68d94c644
        SHA1 : c9ad3cf2b59f4335e92a0640a51c4c52196f7836
        SHA256: aa24f9656f6e05d6640100c4d263a6189efdbb102aff72fd8e69c366d8e69cc9
        TrID : File type identification
        Unknown!
        ssdeep: 12:tKT0GWo29iS7fwdRbXc6cw49iFMXFPYjW/QakgNOfwv1SvWdg4chZ:tKWo29iSbyNM9hyW/zh6JA3chZ
        PEiD : -
        RDS : NSRL Reference Data Set
        -
        0
    5. Narco!4 Contributeur
      supprime C:\WINDOWS\System32\Tqpr4.vbs
      puis relance genproc via le raccourci présent sur ton bureau
      poste et suit cette manip.
      0
      1. caledolove
        ok je supprime et recommence.
        0
    6. caledolove
      voila

      Rapport GenProc 2.627 [2] - 15/09/2009 à 13:26:45
      @ Windows XP Service Pack 3 - Mode normal
      @ Internet Explorer (8.0.6001.18702) [Navigateur par défaut]

      GenProc n'a détecté aucune infection caractéristique et suggère de suivre la procédure suivante :

      Poste un rapport Nod32 https://www.eset.com/ (il faut utiliser Internet Explorer)
      - coche toutes les cases à chaque fois, et lorsque c'est terminé, colle le rapport :
      C:\Program Files\EsetOnlineScanner\log.txt

      ~~~~ INFORMATION COMPLEMENTAIRE ~~~~

      Logfile of Trend Micro HijackThis v2.0.2
      Scan saved at 13:40:41, on 15/09/2009
      Platform: Windows XP SP3 (WinNT 5.01.2600)
      MSIE: Internet Explorer v8.00 (8.00.6001.18702)
      Boot mode: Normal

      Running processes:
      C:\WINDOWS\System32\smss.exe
      C:\WINDOWS\system32\csrss.exe
      C:\WINDOWS\system32\winlogon.exe
      C:\WINDOWS\system32\services.exe
      C:\WINDOWS\system32\lsass.exe
      C:\WINDOWS\system32\svchost.exe
      C:\WINDOWS\system32\svchost.exe
      C:\Program Files\Windows Defender\MsMpEng.exe
      C:\WINDOWS\System32\svchost.exe
      C:\WINDOWS\system32\svchost.exe
      C:\WINDOWS\system32\svchost.exe
      C:\Program Files\Lavasoft\Ad-Aware\AAWService.exe
      C:\WINDOWS\system32\spoolsv.exe
      C:\WINDOWS\system32\svchost.exe
      C:\Program Files\Ashampoo\Ashampoo AntiSpyWare 2\AntiSpyWareService.exe
      C:\Program Files\Microsoft Small Business\Business Contact Manager\BcmSqlStartupSvc.exe
      C:\WINDOWS\Explorer.EXE
      C:\Program Files\Bonjour\mDNSResponder.exe
      C:\Program Files\Java\jre6\bin\jqs.exe
      C:\Program Files\Fichiers communs\Nero\Nero BackItUp 4\NBService.exe
      C:\Program Files\Norton Internet Security\Engine\16.7.2.11\ccSvcHst.exe
      C:\WINDOWS\system32\nvsvc32.exe
      C:\Program Files\Microsoft SQL Server\90\Shared\sqlbrowser.exe
      C:\Program Files\Microsoft SQL Server\90\Shared\sqlwriter.exe
      C:\WINDOWS\system32\svchost.exe
      C:\WINDOWS\system32\DRIVERS\WtSrv.exe
      C:\Program Files\Norton Internet Security\Engine\16.7.2.11\ccSvcHst.exe
      C:\WINDOWS\system32\wbem\wmiapsrv.exe
      C:\WINDOWS\system32\wbem\unsecapp.exe
      C:\WINDOWS\System32\alg.exe
      C:\WINDOWS\system32\wbem\wmiprvse.exe
      C:\WINDOWS\RTHDCPL.EXE
      C:\WINDOWS\system32\RUNDLL32.EXE
      C:\Program Files\Adobe\Acrobat 8.0\Acrobat\Acrotray.exe
      C:\Program Files\NOBRAND\802.11g Wireless USB Adapter\PRISMSVR.EXE
      C:\WINDOWS\system32\WService.EXE
      C:\Program Files\Fichiers communs\Real\Update_OB\realsched.exe
      C:\Program Files\Java\jre6\bin\jusched.exe
      C:\Program Files\Ashampoo\Ashampoo AntiSpyWare 2\AntiSpyWare2Guard.exe
      C:\Program Files\Lavasoft\Ad-Aware\AAWTray.exe
      C:\Program Files\Windows Defender\MSASCui.exe
      C:\WINDOWS\system32\ctfmon.exe
      C:\Program Files\NOBRAND\802.11g Wireless USB Adapter\NB11GUTI.exe
      C:\Program Files\Fichiers communs\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe
      C:\Program Files\Internet Explorer\iexplore.exe
      C:\WINDOWS\system32\rundll32.exe
      C:\Program Files\Windows Live\Messenger\msnmsgr.exe
      C:\Program Files\Internet Explorer\iexplore.exe
      C:\WINDOWS\system32\cmd.exe
      C:\Program Files\Internet Explorer\iexplore.exe
      C:\Program Files\Internet Explorer\iexplore.exe
      C:\GenProc\outil\Franck_GenProc.exe
      C:\WINDOWS\system32\wbem\wmiprvse.exe

      R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://www.ldlc.com/
      R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
      R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://outlook.live.com/owa/
      R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://www.msn.com/fr-fr/?ocid=iehp
      R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
      R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
      R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.msn.com/fr-fr/?ocid=iehp
      R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Windows Internet Explorer [Fourni Par LDLC.com]
      R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
      R3 - URLSearchHook: Yahoo! Toolbar avec bloqueur de fenêtres pop-up - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - (no file)
      O2 - BHO: Aide pour le lien d'Adobe PDF Reader - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Fichiers communs\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
      O2 - BHO: Skype add-on (mastermind) - {22BF413B-C6D2-4d91-82A9-A0F997BA588C} - C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll
      O2 - BHO: RealPlayer Download and Record Plugin for Internet Explorer - {3049C3E9-B461-4BC5-8870-4C09146192CA} - C:\Program Files\Real\RealPlayer\rpbrowserrecordplugin.dll
      O2 - BHO: (no name) - {5C255C8A-E604-49b4-9D64-90988571CECB} - (no file)
      O2 - BHO: Symantec NCO BHO - {602ADB0E-4AFF-4217-8AA1-95DAC4DFA408} - C:\Program Files\Norton Internet Security\Engine\16.7.2.11\coIEPlg.dll
      O2 - BHO: Symantec Intrusion Prevention - {6D53EC84-6AAE-4787-AEEE-F4628F01010C} - C:\Program Files\Norton Internet Security\Engine\16.7.2.11\IPSBHO.DLL
      O2 - BHO: Programme d'aide de l'Assistant de connexion Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
      O2 - BHO: Adobe PDF Conversion Toolbar Helper - {AE7CD045-E861-484f-8273-0445EE161910} - C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll
      O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
      O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
      O3 - Toolbar: Adobe PDF - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll
      O3 - Toolbar: Norton Toolbar - {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} - C:\Program Files\Norton Internet Security\Engine\16.7.2.11\coIEPlg.dll
      O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE
      O4 - HKLM\..\Run: [Alcmtr] ALCMTR.EXE
      O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
      O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
      O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
      O4 - HKLM\..\Run: [Acrobat Assistant 8.0] "C:\Program Files\Adobe\Acrobat 8.0\Acrobat\Acrotray.exe"
      O4 - HKLM\..\Run: [Adobe_ID0EYTHM] C:\PROGRA~1\FICHIE~1\Adobe\ADOBEV~1\Server\bin\VERSIO~2.EXE
      O4 - HKLM\..\Run: [WService] WService.EXE
      O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
      O4 - HKLM\..\Run: [PRISMSVR.EXE] "C:\Program Files\NOBRAND\802.11g Wireless USB Adapter\PRISMSVR.EXE" /APPLY
      O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Fichiers communs\Real\Update_OB\realsched.exe" -osboot
      O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe"
      O4 - HKLM\..\Run: ['Ashampoo AntiSpyWare 2 Guard'] C:\Program Files\Ashampoo\Ashampoo AntiSpyWare 2\AntiSpyWare2Guard.exe
      O4 - HKLM\..\Run: [Ad-Watch] C:\Program Files\Lavasoft\Ad-Aware\AAWTray.exe
      O4 - HKLM\..\Run: [Windows Defender] "C:\Program Files\Windows Defender\MSASCui.exe" -hide
      O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
      O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE LOCAL')
      O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE RÉSEAU')
      O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
      O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
      O4 - Global Startup: 802.11g Wireless USB Adapter Utility.lnk = C:\Program Files\NOBRAND\802.11g Wireless USB Adapter\NB11GUTI.exe
      O8 - Extra context menu item: Ajouter au fichier PDF existant - res://C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
      O8 - Extra context menu item: Convertir en Adobe PDF - res://C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
      O8 - Extra context menu item: Convertir la cible du lien en Adobe PDF - res://C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
      O8 - Extra context menu item: Convertir la cible du lien en un fichier PDF existant - res://C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
      O8 - Extra context menu item: Convertir la sélection en Adobe PDF - res://C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
      O8 - Extra context menu item: Convertir la sélection en un fichier PDF existant - res://C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
      O8 - Extra context menu item: Convertir les liens sélectionnés en fichier Adobe PDF - res://C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIECaptureSelLinks.html
      O8 - Extra context menu item: Convertir les liens sélectionnés en un fichier PDF existant - res://C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIEAppendSelLinks.html
      O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~3\Office12\EXCEL.EXE/3000
      O9 - Extra button: Skype - {77BF5300-1474-4EC7-9980-D32B190E9B07} - C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll
      O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~3\Office12\REFIEBAR.DLL
      O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
      O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
      O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
      O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
      O16 - DPF: {084DAC27-6FA3-4F55-9005-033F2F102F5C} (ITPPDiagIE Class) - http://data.jeuxclassiques.com/npwwg.cab
      O16 - DPF: {0CCA191D-13A6-4E29-B746-314DEE697D83} (Facebook Photo Uploader 5 Control) - http://upload.facebook.com/controls/2008.10.10_v5.5.8/FacebookPhotoUploader5.cab
      O16 - DPF: {6A344D34-5231-452A-8A57-D064AC9B7862} (Symantec Download Manager) - https://webdl.symantec.com/activex/symdlmgr.cab
      O16 - DPF: {8100D56A-5661-482C-BEE8-AFECE305D968} (Facebook Photo Uploader 5 Control) - http://upload.facebook.com/controls/2009.07.28_v5.5.8.1/FacebookPhotoUploader55.cab
      O17 - HKLM\System\CCS\Services\Tcpip\..\{04705497-0624-4D07-94E9-927BEF887EF9}: NameServer = 212.217.0.1,212.217.0.12
      O17 - HKLM\System\CS1\Services\Tcpip\..\{04705497-0624-4D07-94E9-927BEF887EF9}: NameServer = 212.217.0.1,212.217.0.12
      O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\FICHIE~1\Skype\SKYPE4~1.DLL
      O18 - Protocol: symres - {AA1061FE-6C41-421F-9344-69640C9732AB} - C:\Program Files\Norton Internet Security\Engine\16.7.2.11\coIEPlg.dll
      O20 - AppInit_DLLs: C:\WINDOWS\System32\ds16gt32.dll
      O20 - Winlogon Notify: d444d054669 - C:\WINDOWS\System32\ds16gt32.dll
      O23 - Service: Ashampoo AntiSpyWare 2 Service (AASW2_Service) - Unknown owner - C:\Program Files\Ashampoo\Ashampoo AntiSpyWare 2\AntiSpyWareService.exe
      O23 - Service: Adobe Version Cue CS3 {fr_FR} (Adobe Version Cue CS3) - Adobe Systems Incorporated - C:\Program Files\Fichiers communs\Adobe\Adobe Version Cue CS3\Server\bin\VersionCueCS3.exe
      O23 - Service: ##Id_String1.6844F930_1628_4223_B5CC_5BB94B879762## (Bonjour Service) - Apple Computer, Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
      O23 - Service: FLEXnet Licensing Service - Macrovision Europe Ltd. - C:\Program Files\Fichiers communs\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe
      O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Fichiers communs\InstallShield\Driver\11\Intel 32\IDriverT.exe
      O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe
      O23 - Service: Lavasoft Ad-Aware Service - Lavasoft - C:\Program Files\Lavasoft\Ad-Aware\AAWService.exe
      O23 - Service: Nero BackItUp Scheduler 4.0 - Nero AG - C:\Program Files\Fichiers communs\Nero\Nero BackItUp 4\NBService.exe
      O23 - Service: Norton Internet Security - Symantec Corporation - C:\Program Files\Norton Internet Security\Engine\16.7.2.11\ccSvcHst.exe
      O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
      O23 - Service: Planificateur LiveUpdate automatique - Unknown owner - C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe (file missing)
      O23 - Service: WinTab Service (WinTabService) - Tablet Driver - C:\WINDOWS\system32\DRIVERS\WtSrv.exe
      0
      1. Narco!4 Contributeur
        Poste un rapport Nod32 https://www.eset.com/ (il faut utiliser Internet Explorer)
        - coche toutes les cases à chaque fois, et lorsque c'est terminé, colle le rapport :
        C:\Program Files\EsetOnlineScanner\log.txt
        0
        1. caledolove
          voici le rapport Eset scanner

          ESETSmartInstaller@High as CAB hook log:
          OnlineScanner.ocx - registred OK
          # version=6
          # iexplore.exe=8.00.6001.18702 (longhorn_ie8_rtm(wmbla).090308-0339)
          # OnlineScanner.ocx=1.0.0.6050
          # api_version=3.0.2
          # EOSSerial=c6895dadd6113b4f923b40fb0811111c
          # end=finished
          # remove_checked=true
          # archives_checked=true
          # unwanted_checked=true
          # unsafe_checked=false
          # antistealth_checked=true
          # utc_time=2009-09-15 12:45:47
          # local_time=2009-09-15 02:45:47 (+0100, Paris, Madrid (heure d'été))
          # country="France"
          # lang=1036
          # osver=5.1.2600 NT Service Pack 3
          # compatibility_mode=3588 61 100 96 5705337031250
          # compatibility_mode=5889 61 66 100 775018817968750
          # scanned=140217
          # found=14
          # cleaned=13
          # scan_time=3088
          C:\Documents and Settings\All Users\Application Data\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\Norton\BASH\Clone\BHC78.tmp a variant of Win32/Kryptik.AJU trojan (unable to clean) 00000000000000000000000000000000 I
          C:\Documents and Settings\Franck\Local Settings\Temp\2.tmp a variant of Win32/Kryptik.AJU trojan (cleaned by deleting - quarantined) 00000000000000000000000000000000 C
          C:\Documents and Settings\Franck\Local Settings\Temp\3.tmp a variant of Win32/Kryptik.AJU trojan (cleaned by deleting - quarantined) 00000000000000000000000000000000 C
          C:\Documents and Settings\Franck\Local Settings\Temp\4.tmp a variant of Win32/Kryptik.AJU trojan (cleaned by deleting - quarantined) 00000000000000000000000000000000 C
          C:\Documents and Settings\Franck\Local Settings\Temp\5.tmp a variant of Win32/Kryptik.AJU trojan (cleaned by deleting (after the next restart) - quarantined) 00000000000000000000000000000000 C
          C:\Documents and Settings\Franck\Local Settings\Temp\7B.tmp a variant of Win32/Kryptik.AJU trojan (cleaned by deleting - quarantined) 00000000000000000000000000000000 C
          C:\Documents and Settings\Franck\Local Settings\Temp\B.tmp a variant of Win32/Kryptik.AJU trojan (cleaned by deleting - quarantined) 00000000000000000000000000000000 C
          C:\WINDOWS\system32\79.tmp a variant of Win32/Kryptik.AJU trojan (cleaned by deleting (after the next restart) - quarantined) 00000000000000000000000000000000 C
          C:\WINDOWS\system32\ds16gt32.dll a variant of Win32/Kryptik.AJU trojan (cleaned by deleting (after the next restart) - quarantined) 00000000000000000000000000000000 C
          C:\WINDOWS\system32\LocalService\289.music.au a variant of WMA/TrojanDownloader.GetCodec.gen trojan (cleaned - quarantined) 00000000000000000000000000000000 C
          C:\WINDOWS\system32\LocalService\290.music2.au a variant of WMA/TrojanDownloader.GetCodec.gen trojan (cleaned - quarantined) 00000000000000000000000000000000 C
          C:\WINDOWS\system32\LocalService\291.music3.au a variant of WMA/TrojanDownloader.GetCodec.gen trojan (cleaned - quarantined) 00000000000000000000000000000000 C
          C:\WINDOWS\system32\LocalService\292.music4.au a variant of WMA/TrojanDownloader.GetCodec.gen trojan (cleaned - quarantined) 00000000000000000000000000000000 C
          ${Memory} a variant of Win32/Kryptik.AJU trojan 00000000000000000000000000000000 C
          0
          1. Narco!4 Contributeur
            [*] Télécharge combofix (sUBs) http://download.bleepingcomputer.com/sUBs/ComboFix.exe sur ton Bureau
            [*] Double clique combofix.exe et suis les instructions.
            [*] Installe la console de récupération si proposé et continue.
            [*] Lorsque le scan sera complété, un rapport apparaîtra. Copie/colle ce rapport dans ta prochaine réponse.

            NOTE : Le rapport se trouve également ici : C:\Combofix.txt
            0
            1. caledolove
              est ce que je dois désinstaller Eset scanner ?
              0
              2. caledolove
                voici le rapport de la fenêtre qui c'est ouverte :

                ComboFix 09-09-14.02 - Franck 15/09/2009 17:50.1.2 - NTFSx86
                Microsoft Windows XP Professionnel 5.1.2600.3.1252.33.1036.18.2047.1179 [GMT 2:00]
                Lancé depuis: c:\documents and settings\Franck\Bureau\ComboFix.exe
                .
                Les fichiers ci-dessous ont été désactivés pendant l'exécution:
                c:\program files\Ashampoo\Ashampoo AntiSpyWare 2\Guard.dll

                (((((((((((((((((((((((((((((((((((( Autres suppressions ))))))))))))))))))))))))))))))))))))))))))))))))
                .

                c:\docume~1\Franck\LOCALS~1\Temp\NOD39B6.tmp
                c:\docume~1\Franck\LOCALS~1\Temp\NODA27F.tmp
                c:\documents and settings\Franck\Application Data\02000000f619a08c669C.manifest
                c:\documents and settings\Franck\Application Data\02000000f619a08c669O.manifest
                c:\documents and settings\Franck\Application Data\02000000f619a08c669P.manifest
                c:\documents and settings\Franck\Application Data\02000000f619a08c669S.manifest
                c:\documents and settings\Franck\Application Data\Microsoft\Internet Explorer\Quick Launch\Ashampoo AntiSpyWare 2.lnk
                c:\documents and settings\Franck\Local Settings\Temp\NOD39B6.tmp
                c:\documents and settings\Franck\Local Settings\Temp\NODA27F.tmp
                c:\windows\GnuHashes.ini
                c:\windows\Installer\b0da1.msi
                c:\windows\Installer\b0da6.msi
                c:\windows\system32\DS16GT32.DLL
                c:\windows\system32\GroupPolicy000.dat
                c:\windows\system32\LocalService\285.crack.zip
                c:\windows\system32\LocalService\285.crack.zip.kwd
                c:\windows\system32\LocalService\286.keygen.zip
                c:\windows\system32\LocalService\286.keygen.zip.kwd
                c:\windows\system32\LocalService\287.serial.zip
                c:\windows\system32\LocalService\287.serial.zip.kwd
                c:\windows\system32\LocalService\288.setup.zip
                c:\windows\system32\LocalService\288.setup.zip.kwd
                c:\windows\system32\LocalService\289.music.au
                c:\windows\system32\LocalService\289.music.au.kwd
                c:\windows\system32\LocalService\290.music2.au
                c:\windows\system32\LocalService\290.music2.au.kwd
                c:\windows\system32\LocalService\291.music3.au
                c:\windows\system32\LocalService\291.music3.au.kwd
                c:\windows\system32\LocalService\292.music4.au
                c:\windows\system32\LocalService\292.music4.au.kwd
                c:\windows\system32\wservice.exe

                .
                ((((((((((((((((((((((((((((( Fichiers créés du 2009-08-15 au 2009-09-15 ))))))))))))))))))))))))))))))))))))
                .

                2009-09-15 11:52 . 2009-09-15 11:52 -------- d-----w- c:\program files\ESET
                2009-09-15 10:47 . 2009-09-15 11:26 -------- d-----w- C:\GenProc
                2009-09-15 06:01 . 2009-09-15 06:01 -------- d-----w- c:\program files\Windows Defender
                2009-09-15 02:59 . 2009-09-14 18:50 15688 ----a-w- c:\windows\system32\lsdelete.exe
                2009-09-14 19:07 . 2009-09-14 19:07 -------- d-----w- c:\documents and settings\LocalService\Bureau
                2009-09-14 18:50 . 2009-09-14 18:50 64160 ----a-w- c:\windows\system32\drivers\Lbd.sys
                2009-09-14 18:47 . 2009-09-14 18:47 -------- dc-h--w- c:\documents and settings\All Users\Application Data\{83C91755-2546-441D-AC40-9A6B4B860800}
                2009-09-14 18:47 . 2009-09-14 18:50 -------- d-----w- c:\documents and settings\All Users\Application Data\Lavasoft
                2009-09-14 18:47 . 2009-09-14 18:47 -------- d-----w- c:\program files\Lavasoft
                2009-09-14 18:00 . 2009-09-14 18:00 -------- d-----w- c:\documents and settings\Franck\Local Settings\Application Data\Ashampoo
                2009-09-14 16:58 . 2009-09-14 16:58 -------- d-----w- c:\program files\Ashampoo
                2009-09-13 18:45 . 2009-09-15 15:53 -------- d-sh--w- c:\windows\system32\LocalService
                2009-09-06 08:12 . 2009-09-08 08:35 -------- d-----w- c:\program files\Microsoft Money 2005
                2009-08-18 14:07 . 2009-08-18 14:07 -------- d-----w- c:\windows\system32\XPSViewer
                2009-08-18 14:07 . 2009-08-18 14:07 -------- d-----w- c:\program files\Reference Assemblies
                2009-08-18 14:07 . 2008-07-06 12:06 89088 -c----w- c:\windows\system32\dllcache\filterpipelineprintproc.dll
                2009-08-18 14:07 . 2008-07-06 12:06 575488 -c----w- c:\windows\system32\dllcache\xpsshhdr.dll
                2009-08-18 14:07 . 2008-07-06 12:06 575488 ------w- c:\windows\system32\xpsshhdr.dll
                2009-08-18 14:07 . 2008-07-06 12:06 1676288 -c----w- c:\windows\system32\dllcache\xpssvcs.dll
                2009-08-18 14:07 . 2008-07-06 12:06 1676288 ------w- c:\windows\system32\xpssvcs.dll
                2009-08-18 14:07 . 2008-07-06 12:06 117760 ------w- c:\windows\system32\prntvpt.dll
                2009-08-18 14:07 . 2008-07-06 10:50 597504 -c----w- c:\windows\system32\dllcache\printfilterpipelinesvc.exe
                2009-08-18 14:02 . 2008-04-13 17:33 221184 ----a-w- c:\windows\system32\wmpns.dll

                .
                (((((((((((((((((((((((((((((((((( Compte-rendu de Find3M ))))))))))))))))))))))))))))))))))))))))))))))))
                .
                2009-09-14 08:37 . 2009-06-10 21:44 -------- d-----w- c:\documents and settings\Franck\Application Data\LimeWire
                2009-09-13 10:06 . 2009-06-10 21:42 -------- d-----w- c:\program files\LimeWire
                2009-09-12 14:17 . 2008-12-31 14:59 -------- d-----w- c:\documents and settings\Franck\Application Data\Skype
                2009-09-12 14:04 . 2008-12-31 15:01 -------- d-----w- c:\documents and settings\Franck\Application Data\skypePM
                2009-09-11 05:33 . 2008-11-15 10:41 60808 ----a-w- c:\windows\system32\S32EVNT1.DLL
                2009-09-11 05:33 . 2008-11-15 10:41 124976 ----a-w- c:\windows\system32\drivers\SYMEVENT.SYS
                2009-09-11 05:33 . 2008-11-15 10:41 -------- d-----w- c:\program files\Symantec
                2009-09-11 05:33 . 2008-10-23 19:06 806 ----a-w- c:\windows\system32\drivers\SYMEVENT.INF
                2009-09-11 05:33 . 2008-10-23 19:06 7456 ----a-w- c:\windows\system32\drivers\SYMEVENT.CAT
                2009-09-11 05:22 . 2008-10-16 13:59 -------- d-----w- c:\program files\Microsoft Silverlight
                2009-09-10 19:36 . 2008-10-17 06:35 -------- d-----w- c:\documents and settings\All Users\Application Data\Microsoft Help
                2009-09-07 14:43 . 2008-10-17 06:44 79520 ----a-w- c:\documents and settings\Administrateur\Local Settings\Application Data\GDIPFONTCACHEV1.DAT
                2009-09-05 13:20 . 2009-01-28 11:12 -------- d-----w- c:\program files\Microsoft Works
                2009-08-22 07:21 . 2008-11-15 10:41 36400 ----a-r- c:\windows\system32\drivers\SymIM.sys
                2009-08-18 14:10 . 2007-08-02 12:00 567984 ----a-w- c:\windows\system32\perfh00C.dat
                2009-08-18 14:10 . 2007-08-02 12:00 108486 ----a-w- c:\windows\system32\perfc00C.dat
                2009-08-18 09:52 . 2009-06-10 21:43 -------- d-----w- c:\program files\Java
                2009-08-05 09:00 . 2008-04-13 17:33 205312 ----a-w- c:\windows\system32\mswebdvd.dll
                2009-07-29 04:35 . 2008-04-13 17:33 119808 ----a-w- c:\windows\system32\t2embed.dll
                2009-07-29 04:35 . 2008-04-13 17:33 81920 ----a-w- c:\windows\system32\fontsub.dll
                2009-07-25 03:23 . 2009-06-10 21:44 411368 ----a-w- c:\windows\system32\deploytk.dll
                2009-07-17 19:03 . 2008-04-13 17:33 58880 ----a-w- c:\windows\system32\atl.dll
                2009-07-13 21:43 . 2008-05-13 08:48 286208 ----a-w- c:\windows\system32\wmpdxm.dll
                2009-07-03 16:57 . 2008-05-13 08:47 915456 ----a-w- c:\windows\system32\wininet.dll
                2009-06-25 08:26 . 2008-04-13 17:33 54272 ----a-w- c:\windows\system32\wdigest.dll
                2009-06-25 08:26 . 2008-04-13 17:33 56832 ----a-w- c:\windows\system32\secur32.dll
                2009-06-25 08:26 . 2008-04-13 17:33 147456 ----a-w- c:\windows\system32\schannel.dll
                2009-06-25 08:26 . 2008-04-13 17:33 136192 ----a-w- c:\windows\system32\msv1_0.dll
                2009-06-25 08:26 . 2008-04-13 17:33 736768 ----a-w- c:\windows\system32\lsasrv.dll
                2009-06-25 08:26 . 2008-04-13 17:33 301568 ----a-w- c:\windows\system32\kerberos.dll
                2009-06-24 11:18 . 2008-04-13 09:31 92928 ----a-w- c:\windows\system32\drivers\ksecdd.sys
                .

                ((((((((((((((((((((((((((((((((( Points de chargement Reg ))))))))))))))))))))))))))))))))))))))))))))))))
                .
                .
                *Note* les éléments vides & les éléments initiaux légitimes ne sont pas listés
                REGEDIT4

                [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
                "NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2007-12-07 8523776]
                "NvMediaCenter"="c:\windows\system32\NvMcTray.dll" [2007-12-07 81920]
                "Acrobat Assistant 8.0"="c:\program files\Adobe\Acrobat 8.0\Acrobat\Acrotray.exe" [2008-10-14 623992]
                "QuickTime Task"="c:\program files\QuickTime\qttask.exe" [2008-09-06 413696]
                "TkBellExe"="c:\program files\Fichiers communs\Real\Update_OB\realsched.exe" [2009-04-20 198160]
                "SunJavaUpdateSched"="c:\program files\Java\jre6\bin\jusched.exe" [2009-07-25 149280]
                "'Ashampoo AntiSpyWare 2 Guard'"="c:\program files\Ashampoo\Ashampoo AntiSpyWare 2\AntiSpyWare2Guard.exe" [2009-07-15 2376536]
                "Ad-Watch"="c:\program files\Lavasoft\Ad-Aware\AAWTray.exe" [2009-09-14 520024]
                "Windows Defender"="c:\program files\Windows Defender\MSASCui.exe" [2006-11-03 866584]
                "RTHDCPL"="RTHDCPL.EXE" - c:\windows\RTHDCPL.exe [2007-09-19 16844800]
                "nwiz"="nwiz.exe" - c:\windows\system32\nwiz.exe [2007-12-07 1626112]

                [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
                "CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2008-04-13 15360]

                c:\documents and settings\All Users\Menu D‚marrer\Programmes\D‚marrage\
                802.11g Wireless USB Adapter Utility.lnk - c:\program files\NOBRAND\802.11g Wireless USB Adapter\NB11GUTI.exe [2005-6-20 323584]

                [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Lavasoft Ad-Aware Service]
                @="Service"

                [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\SymEFA.sys]
                @="FSFilter Activity Monitor"

                [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WinDefend]
                @="Service"

                [HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring]
                "DisableMonitoring"=dword:00000001

                [HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus]
                "DisableMonitoring"=dword:00000001

                [HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecFirewall]
                "DisableMonitoring"=dword:00000001

                [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
                "EnableFirewall"= 0 (0x0)

                [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
                "%windir%\\Network Diagnostic\\xpnetdiag.exe"=
                "%windir%\\system32\\sessmgr.exe"=
                "c:\\Program Files\\Bonjour\\mDNSResponder.exe"=
                "c:\\Program Files\\Fichiers communs\\Adobe\\Adobe Version Cue CS3\\Server\\bin\\VersionCueCS3.exe"=
                "c:\\Program Files\\eMule\\emule.exe"=
                "c:\\Program Files\\Microsoft Office\\Office12\\OUTLOOK.EXE"=
                "c:\\Program Files\\InstantTouch\\bin\\CmCenterV2.exe"=
                "c:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"=
                "c:\\Program Files\\LimeWire\\LimeWire.exe"=
                "c:\\Program Files\\Real\\RealPlayer\\realplay.exe"=
                "c:\\Program Files\\Skype\\Phone\\Skype.exe"=

                [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
                "3703:TCP"= 3703:TCP:Adobe Version Cue CS3 Server
                "3704:TCP"= 3704:TCP:Adobe Version Cue CS3 Server
                "50900:TCP"= 50900:TCP:Adobe Version Cue CS3 Server
                "50901:TCP"= 50901:TCP:Adobe Version Cue CS3 Server

                R0 Lbd;Lbd;c:\windows\system32\drivers\Lbd.sys [14/09/2009 20:50 64160]
                R0 SymEFA;Symantec Extended File Attributes;c:\windows\system32\drivers\NIS\1007020.00B\SymEFA.sys [09/09/2009 00:17 310320]
                R1 BHDrvx86;Symantec Heuristics Driver;c:\windows\system32\drivers\NIS\1007020.00B\BHDrvx86.sys [09/09/2009 00:17 259632]
                R1 ccHP;Symantec Hash Provider;c:\windows\system32\drivers\NIS\1007020.00B\cchpx86.sys [09/09/2009 00:16 482432]
                R1 IDSxpx86;IDSxpx86;c:\documents and settings\All Users\Application Data\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\Norton\Definitions\IPSDefs\20090910.003\IDSXpx86.sys [11/09/2009 07:33 276344]
                R2 AASW2_Service;Ashampoo AntiSpyWare 2 Service;c:\program files\Ashampoo\Ashampoo AntiSpyWare 2\AntiSpyWareService.exe [14/09/2009 18:59 749912]
                R2 BcmSqlStartupSvc;Service de démarrage SQL Server pour le Gestionnaire de contacts professionnels;c:\program files\Microsoft Small Business\Business Contact Manager\BcmSqlStartupSvc.exe [16/01/2008 09:46 30312]
                R2 Lavasoft Ad-Aware Service;Lavasoft Ad-Aware Service;c:\program files\Lavasoft\Ad-Aware\AAWService.exe [18/01/2009 23:34 1029456]
                R2 Norton Internet Security;Norton Internet Security;c:\program files\Norton Internet Security\Engine\16.7.2.11\ccSvcHst.exe [09/09/2009 00:17 117640]
                R2 WinDefend;Windows Defender;c:\program files\Windows Defender\MsMpEng.exe [03/11/2006 19:19 13592]
                R3 A4501A;802.11g Wireless USB Adapter Driver;c:\windows\system32\drivers\A4501A.sys [13/03/2009 12:25 357408]
                R3 EraserUtilRebootDrv;EraserUtilRebootDrv;c:\program files\Fichiers communs\Symantec Shared\EENGINE\EraserUtilRebootDrv.sys [29/08/2009 10:00 102448]
                S3 MSSQL$MSSMLBIZ;SQL Server (MSSMLBIZ);c:\program files\Microsoft SQL Server\MSSQL.1\MSSQL\Binn\sqlservr.exe [24/11/2008 23:31 29263712]
                S3 P1171VID;Creative WebCam Notebook #2;c:\windows\system32\drivers\P1171Vid.sys [09/02/2009 20:13 91392]
                S3 qcusbser;Mobile Connector USB Device for Legacy Serial Communication;c:\windows\system32\drivers\cmusbser.sys [14/11/2008 16:40 97408]
                S3 ZDCndis5;ZDCndis5 Protocol Driver;\??\c:\windows\system32\ZDCndis5.SYS --> c:\windows\system32\ZDCndis5.SYS [?]

                --- Autres Services/Pilotes en mémoire ---

                *Deregistered* - mchInjDrv

                [HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\>{60B49E34-C7CC-11D0-8953-00A0C90347FF}]
                "c:\windows\system32\rundll32.exe" "c:\windows\system32\iedkcs32.dll",BrandIEActiveSetup SIGNUP
                .
                Contenu du dossier 'Tâches planifiées'

                2009-09-14 c:\windows\Tasks\Ad-Aware Update (Weekly).job
                - c:\program files\Lavasoft\Ad-Aware\Ad-AwareAdmin.exe [2009-01-18 18:49]

                2009-09-09 c:\windows\Tasks\AppleSoftwareUpdate.job
                - c:\program files\Apple Software Update\SoftwareUpdate.exe [2008-07-30 12:34]

                2009-09-15 c:\windows\Tasks\MP Scheduled Scan.job
                - c:\program files\Windows Defender\MpCmdRun.exe [2006-11-03 17:20]

                2009-09-15 c:\windows\Tasks\User_Feed_Synchronization-{C018398D-4AC6-4472-8374-9063B928C213}.job
                - c:\windows\system32\msfeedssync.exe [2008-05-13 03:31]
                .
                .
                ------- Examen supplémentaire -------
                .
                uStart Page = hxxp://home.live.com/
                uInternet Settings,ProxyOverride = <local>;*.local
                IE: Ajouter au fichier PDF existant - c:\program files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
                IE: Convertir en Adobe PDF - c:\program files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
                IE: Convertir la cible du lien en Adobe PDF - c:\program files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
                IE: Convertir la cible du lien en un fichier PDF existant - c:\program files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
                IE: Convertir la sélection en Adobe PDF - c:\program files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
                IE: Convertir la sélection en un fichier PDF existant - c:\program files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
                IE: Convertir les liens sélectionnés en fichier Adobe PDF - c:\program files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIECaptureSelLinks.html
                IE: Convertir les liens sélectionnés en un fichier PDF existant - c:\program files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIEAppendSelLinks.html
                IE: E&xporter vers Microsoft Excel - c:\progra~1\MICROS~3\Office12\EXCEL.EXE/3000
                TCP: {04705497-0624-4D07-94E9-927BEF887EF9} = 212.217.0.1,212.217.0.12
                DPF: {084DAC27-6FA3-4F55-9005-033F2F102F5C} - hxxp://data.jeuxclassiques.com/npwwg.cab
                DPF: {7530BFB8-7293-4D34-9923-61A11451AFC5} - hxxp://download.eset.com/special/eos/OnlineScanner.cab
                .
                - - - - ORPHELINS SUPPRIMES - - - -

                HKLM-Run-PRISMSVR.EXE - c:\program files\NOBRAND\802.11g
                HKLM-Run-WService - WService.EXE
                Notify-d444d054669 - c:\windows\System32\ds16gt32.dll
                AddRemove-Creative PD1171 - c:\windows\CtDrvIns.exe -uninstall -script Pd1171.uns -unsext NT -plugin P1171Pin.dll
                AddRemove-HijackThis - c:\genproc\outil\HijackThis.exe
                AddRemove-{29943E04-5E17-416A-9876-41EE64BF88E9}}[Files]_is1 - c:\program files\Packard Bell\Driver CD Creator\unins000.exe

                **************************************************************************

                catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
                Rootkit scan 2009-09-15 17:56
                Windows 5.1.2600 Service Pack 3 NTFS

                Recherche de processus cachés ...

                Recherche d'éléments en démarrage automatique cachés ...

                Recherche de fichiers cachés ...

                c:\windows\TEMP\TMP00000010061A663AD088AA17 524288 bytes executable

                Scan terminé avec succès
                Fichiers cachés: 1

                **************************************************************************

                [HKEY_LOCAL_MACHINE\System\ControlSet001\Services\Norton Internet Security]
                "ImagePath"="\"c:\program files\Norton Internet Security\Engine\16.7.2.11\ccSvcHst.exe\" /s \"Norton Internet Security\" /m \"c:\program files\Norton Internet Security\Engine\16.7.2.11\diMaster.dll\" /prefetch:1"
                .
                --------------------- DLLs chargées dans les processus actifs ---------------------

                - - - - - - - > 'winlogon.exe'(1464)
                c:\program files\Ashampoo\Ashampoo AntiSpyWare 2\Guard.dll

                - - - - - - - > 'lsass.exe'(1520)
                c:\program files\Ashampoo\Ashampoo AntiSpyWare 2\Guard.dll

                - - - - - - - > 'explorer.exe'(3116)
                c:\program files\Ashampoo\Ashampoo AntiSpyWare 2\Guard.dll
                c:\windows\system32\eappprxy.dll
                c:\windows\system32\webcheck.dll
                c:\windows\system32\WPDShServiceObj.dll
                c:\windows\system32\PortableDeviceTypes.dll
                c:\windows\system32\PortableDeviceApi.dll

                - - - - - - - > 'csrss.exe'(1440)
                c:\program files\Ashampoo\Ashampoo AntiSpyWare 2\Guard.dll
                .
                ------------------------ Autres processus actifs ------------------------
                .
                c:\program files\Bonjour\mDNSResponder.exe
                c:\program files\Java\jre6\bin\jqs.exe
                c:\program files\Fichiers communs\Nero\Nero BackItUp 4\NBService.exe
                c:\windows\system32\nvsvc32.exe
                c:\program files\Microsoft SQL Server\90\Shared\sqlbrowser.exe
                c:\program files\Microsoft SQL Server\90\Shared\sqlwriter.exe
                c:\windows\system32\drivers\WTSrv.exe
                c:\windows\system32\wbem\unsecapp.exe
                c:\windows\system32\wbem\wmiapsrv.exe
                c:\program files\Fichiers communs\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe
                c:\program files\NOBRAND\802.11g Wireless USB Adapter\PRISMSVR.exe
                .
                **************************************************************************
                .
                Heure de fin: 2009-09-15 18:00 - La machine a redémarré
                ComboFix-quarantined-files.txt 2009-09-15 16:00

                Avant-CF: 15 280 189 440 octets libres
                Après-CF: 19 529 547 776 octets libres

                WindowsXP-KB310994-SP2-Pro-BootDisk-FRA.exe
                [boot loader]
                timeout=2
                default=multi(0)disk(0)rdisk(0)partition(1)\WINDOWS
                [operating systems]
                c:\cmdcons\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons
                multi(0)disk(0)rdisk(0)partition(1)\WINDOWS="Microsoft Windows XP Professionnel" /noexecute=optin /fastdetect

                264 --- E O F --- 2009-09-10 19:37
                0
                1. caledolove
                  et voici le fichier combofix :

                  ComboFix 09-09-14.02 - Franck 15/09/2009 17:50.1.2 - NTFSx86
                  Microsoft Windows XP Professionnel 5.1.2600.3.1252.33.1036.18.2047.1179 [GMT 2:00]
                  Lancé depuis: c:\documents and settings\Franck\Bureau\ComboFix.exe
                  .
                  Les fichiers ci-dessous ont été désactivés pendant l'exécution:
                  c:\program files\Ashampoo\Ashampoo AntiSpyWare 2\Guard.dll

                  (((((((((((((((((((((((((((((((((((( Autres suppressions ))))))))))))))))))))))))))))))))))))))))))))))))
                  .

                  c:\docume~1\Franck\LOCALS~1\Temp\NOD39B6.tmp
                  c:\docume~1\Franck\LOCALS~1\Temp\NODA27F.tmp
                  c:\documents and settings\Franck\Application Data\02000000f619a08c669C.manifest
                  c:\documents and settings\Franck\Application Data\02000000f619a08c669O.manifest
                  c:\documents and settings\Franck\Application Data\02000000f619a08c669P.manifest
                  c:\documents and settings\Franck\Application Data\02000000f619a08c669S.manifest
                  c:\documents and settings\Franck\Application Data\Microsoft\Internet Explorer\Quick Launch\Ashampoo AntiSpyWare 2.lnk
                  c:\documents and settings\Franck\Local Settings\Temp\NOD39B6.tmp
                  c:\documents and settings\Franck\Local Settings\Temp\NODA27F.tmp
                  c:\windows\GnuHashes.ini
                  c:\windows\Installer\b0da1.msi
                  c:\windows\Installer\b0da6.msi
                  c:\windows\system32\DS16GT32.DLL
                  c:\windows\system32\GroupPolicy000.dat
                  c:\windows\system32\LocalService\285.crack.zip
                  c:\windows\system32\LocalService\285.crack.zip.kwd
                  c:\windows\system32\LocalService\286.keygen.zip
                  c:\windows\system32\LocalService\286.keygen.zip.kwd
                  c:\windows\system32\LocalService\287.serial.zip
                  c:\windows\system32\LocalService\287.serial.zip.kwd
                  c:\windows\system32\LocalService\288.setup.zip
                  c:\windows\system32\LocalService\288.setup.zip.kwd
                  c:\windows\system32\LocalService\289.music.au
                  c:\windows\system32\LocalService\289.music.au.kwd
                  c:\windows\system32\LocalService\290.music2.au
                  c:\windows\system32\LocalService\290.music2.au.kwd
                  c:\windows\system32\LocalService\291.music3.au
                  c:\windows\system32\LocalService\291.music3.au.kwd
                  c:\windows\system32\LocalService\292.music4.au
                  c:\windows\system32\LocalService\292.music4.au.kwd
                  c:\windows\system32\wservice.exe

                  .
                  ((((((((((((((((((((((((((((( Fichiers créés du 2009-08-15 au 2009-09-15 ))))))))))))))))))))))))))))))))))))
                  .

                  2009-09-15 11:52 . 2009-09-15 11:52 -------- d-----w- c:\program files\ESET
                  2009-09-15 10:47 . 2009-09-15 11:26 -------- d-----w- C:\GenProc
                  2009-09-15 06:01 . 2009-09-15 06:01 -------- d-----w- c:\program files\Windows Defender
                  2009-09-15 02:59 . 2009-09-14 18:50 15688 ----a-w- c:\windows\system32\lsdelete.exe
                  2009-09-14 19:07 . 2009-09-14 19:07 -------- d-----w- c:\documents and settings\LocalService\Bureau
                  2009-09-14 18:50 . 2009-09-14 18:50 64160 ----a-w- c:\windows\system32\drivers\Lbd.sys
                  2009-09-14 18:47 . 2009-09-14 18:47 -------- dc-h--w- c:\documents and settings\All Users\Application Data\{83C91755-2546-441D-AC40-9A6B4B860800}
                  2009-09-14 18:47 . 2009-09-14 18:50 -------- d-----w- c:\documents and settings\All Users\Application Data\Lavasoft
                  2009-09-14 18:47 . 2009-09-14 18:47 -------- d-----w- c:\program files\Lavasoft
                  2009-09-14 18:00 . 2009-09-14 18:00 -------- d-----w- c:\documents and settings\Franck\Local Settings\Application Data\Ashampoo
                  2009-09-14 16:58 . 2009-09-14 16:58 -------- d-----w- c:\program files\Ashampoo
                  2009-09-13 18:45 . 2009-09-15 15:53 -------- d-sh--w- c:\windows\system32\LocalService
                  2009-09-06 08:12 . 2009-09-08 08:35 -------- d-----w- c:\program files\Microsoft Money 2005
                  2009-08-18 14:07 . 2009-08-18 14:07 -------- d-----w- c:\windows\system32\XPSViewer
                  2009-08-18 14:07 . 2009-08-18 14:07 -------- d-----w- c:\program files\Reference Assemblies
                  2009-08-18 14:07 . 2008-07-06 12:06 89088 -c----w- c:\windows\system32\dllcache\filterpipelineprintproc.dll
                  2009-08-18 14:07 . 2008-07-06 12:06 575488 -c----w- c:\windows\system32\dllcache\xpsshhdr.dll
                  2009-08-18 14:07 . 2008-07-06 12:06 575488 ------w- c:\windows\system32\xpsshhdr.dll
                  2009-08-18 14:07 . 2008-07-06 12:06 1676288 -c----w- c:\windows\system32\dllcache\xpssvcs.dll
                  2009-08-18 14:07 . 2008-07-06 12:06 1676288 ------w- c:\windows\system32\xpssvcs.dll
                  2009-08-18 14:07 . 2008-07-06 12:06 117760 ------w- c:\windows\system32\prntvpt.dll
                  2009-08-18 14:07 . 2008-07-06 10:50 597504 -c----w- c:\windows\system32\dllcache\printfilterpipelinesvc.exe
                  2009-08-18 14:02 . 2008-04-13 17:33 221184 ----a-w- c:\windows\system32\wmpns.dll

                  .
                  (((((((((((((((((((((((((((((((((( Compte-rendu de Find3M ))))))))))))))))))))))))))))))))))))))))))))))))
                  .
                  2009-09-14 08:37 . 2009-06-10 21:44 -------- d-----w- c:\documents and settings\Franck\Application Data\LimeWire
                  2009-09-13 10:06 . 2009-06-10 21:42 -------- d-----w- c:\program files\LimeWire
                  2009-09-12 14:17 . 2008-12-31 14:59 -------- d-----w- c:\documents and settings\Franck\Application Data\Skype
                  2009-09-12 14:04 . 2008-12-31 15:01 -------- d-----w- c:\documents and settings\Franck\Application Data\skypePM
                  2009-09-11 05:33 . 2008-11-15 10:41 60808 ----a-w- c:\windows\system32\S32EVNT1.DLL
                  2009-09-11 05:33 . 2008-11-15 10:41 124976 ----a-w- c:\windows\system32\drivers\SYMEVENT.SYS
                  2009-09-11 05:33 . 2008-11-15 10:41 -------- d-----w- c:\program files\Symantec
                  2009-09-11 05:33 . 2008-10-23 19:06 806 ----a-w- c:\windows\system32\drivers\SYMEVENT.INF
                  2009-09-11 05:33 . 2008-10-23 19:06 7456 ----a-w- c:\windows\system32\drivers\SYMEVENT.CAT
                  2009-09-11 05:22 . 2008-10-16 13:59 -------- d-----w- c:\program files\Microsoft Silverlight
                  2009-09-10 19:36 . 2008-10-17 06:35 -------- d-----w- c:\documents and settings\All Users\Application Data\Microsoft Help
                  2009-09-07 14:43 . 2008-10-17 06:44 79520 ----a-w- c:\documents and settings\Administrateur\Local Settings\Application Data\GDIPFONTCACHEV1.DAT
                  2009-09-05 13:20 . 2009-01-28 11:12 -------- d-----w- c:\program files\Microsoft Works
                  2009-08-22 07:21 . 2008-11-15 10:41 36400 ----a-r- c:\windows\system32\drivers\SymIM.sys
                  2009-08-18 14:10 . 2007-08-02 12:00 567984 ----a-w- c:\windows\system32\perfh00C.dat
                  2009-08-18 14:10 . 2007-08-02 12:00 108486 ----a-w- c:\windows\system32\perfc00C.dat
                  2009-08-18 09:52 . 2009-06-10 21:43 -------- d-----w- c:\program files\Java
                  2009-08-05 09:00 . 2008-04-13 17:33 205312 ----a-w- c:\windows\system32\mswebdvd.dll
                  2009-07-29 04:35 . 2008-04-13 17:33 119808 ----a-w- c:\windows\system32\t2embed.dll
                  2009-07-29 04:35 . 2008-04-13 17:33 81920 ----a-w- c:\windows\system32\fontsub.dll
                  2009-07-25 03:23 . 2009-06-10 21:44 411368 ----a-w- c:\windows\system32\deploytk.dll
                  2009-07-17 19:03 . 2008-04-13 17:33 58880 ----a-w- c:\windows\system32\atl.dll
                  2009-07-13 21:43 . 2008-05-13 08:48 286208 ----a-w- c:\windows\system32\wmpdxm.dll
                  2009-07-03 16:57 . 2008-05-13 08:47 915456 ----a-w- c:\windows\system32\wininet.dll
                  2009-06-25 08:26 . 2008-04-13 17:33 54272 ----a-w- c:\windows\system32\wdigest.dll
                  2009-06-25 08:26 . 2008-04-13 17:33 56832 ----a-w- c:\windows\system32\secur32.dll
                  2009-06-25 08:26 . 2008-04-13 17:33 147456 ----a-w- c:\windows\system32\schannel.dll
                  2009-06-25 08:26 . 2008-04-13 17:33 136192 ----a-w- c:\windows\system32\msv1_0.dll
                  2009-06-25 08:26 . 2008-04-13 17:33 736768 ----a-w- c:\windows\system32\lsasrv.dll
                  2009-06-25 08:26 . 2008-04-13 17:33 301568 ----a-w- c:\windows\system32\kerberos.dll
                  2009-06-24 11:18 . 2008-04-13 09:31 92928 ----a-w- c:\windows\system32\drivers\ksecdd.sys
                  .

                  ((((((((((((((((((((((((((((((((( Points de chargement Reg ))))))))))))))))))))))))))))))))))))))))))))))))
                  .
                  .
                  *Note* les éléments vides & les éléments initiaux légitimes ne sont pas listés
                  REGEDIT4

                  [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
                  "NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2007-12-07 8523776]
                  "NvMediaCenter"="c:\windows\system32\NvMcTray.dll" [2007-12-07 81920]
                  "Acrobat Assistant 8.0"="c:\program files\Adobe\Acrobat 8.0\Acrobat\Acrotray.exe" [2008-10-14 623992]
                  "QuickTime Task"="c:\program files\QuickTime\qttask.exe" [2008-09-06 413696]
                  "TkBellExe"="c:\program files\Fichiers communs\Real\Update_OB\realsched.exe" [2009-04-20 198160]
                  "SunJavaUpdateSched"="c:\program files\Java\jre6\bin\jusched.exe" [2009-07-25 149280]
                  "'Ashampoo AntiSpyWare 2 Guard'"="c:\program files\Ashampoo\Ashampoo AntiSpyWare 2\AntiSpyWare2Guard.exe" [2009-07-15 2376536]
                  "Ad-Watch"="c:\program files\Lavasoft\Ad-Aware\AAWTray.exe" [2009-09-14 520024]
                  "Windows Defender"="c:\program files\Windows Defender\MSASCui.exe" [2006-11-03 866584]
                  "RTHDCPL"="RTHDCPL.EXE" - c:\windows\RTHDCPL.exe [2007-09-19 16844800]
                  "nwiz"="nwiz.exe" - c:\windows\system32\nwiz.exe [2007-12-07 1626112]

                  [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
                  "CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2008-04-13 15360]

                  c:\documents and settings\All Users\Menu D‚marrer\Programmes\D‚marrage\
                  802.11g Wireless USB Adapter Utility.lnk - c:\program files\NOBRAND\802.11g Wireless USB Adapter\NB11GUTI.exe [2005-6-20 323584]

                  [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Lavasoft Ad-Aware Service]
                  @="Service"

                  [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\SymEFA.sys]
                  @="FSFilter Activity Monitor"

                  [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WinDefend]
                  @="Service"

                  [HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring]
                  "DisableMonitoring"=dword:00000001

                  [HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus]
                  "DisableMonitoring"=dword:00000001

                  [HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecFirewall]
                  "DisableMonitoring"=dword:00000001

                  [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
                  "EnableFirewall"= 0 (0x0)

                  [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
                  "%windir%\\Network Diagnostic\\xpnetdiag.exe"=
                  "%windir%\\system32\\sessmgr.exe"=
                  "c:\\Program Files\\Bonjour\\mDNSResponder.exe"=
                  "c:\\Program Files\\Fichiers communs\\Adobe\\Adobe Version Cue CS3\\Server\\bin\\VersionCueCS3.exe"=
                  "c:\\Program Files\\eMule\\emule.exe"=
                  "c:\\Program Files\\Microsoft Office\\Office12\\OUTLOOK.EXE"=
                  "c:\\Program Files\\InstantTouch\\bin\\CmCenterV2.exe"=
                  "c:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"=
                  "c:\\Program Files\\LimeWire\\LimeWire.exe"=
                  "c:\\Program Files\\Real\\RealPlayer\\realplay.exe"=
                  "c:\\Program Files\\Skype\\Phone\\Skype.exe"=

                  [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
                  "3703:TCP"= 3703:TCP:Adobe Version Cue CS3 Server
                  "3704:TCP"= 3704:TCP:Adobe Version Cue CS3 Server
                  "50900:TCP"= 50900:TCP:Adobe Version Cue CS3 Server
                  "50901:TCP"= 50901:TCP:Adobe Version Cue CS3 Server

                  R0 Lbd;Lbd;c:\windows\system32\drivers\Lbd.sys [14/09/2009 20:50 64160]
                  R0 SymEFA;Symantec Extended File Attributes;c:\windows\system32\drivers\NIS\1007020.00B\SymEFA.sys [09/09/2009 00:17 310320]
                  R1 BHDrvx86;Symantec Heuristics Driver;c:\windows\system32\drivers\NIS\1007020.00B\BHDrvx86.sys [09/09/2009 00:17 259632]
                  R1 ccHP;Symantec Hash Provider;c:\windows\system32\drivers\NIS\1007020.00B\cchpx86.sys [09/09/2009 00:16 482432]
                  R1 IDSxpx86;IDSxpx86;c:\documents and settings\All Users\Application Data\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\Norton\Definitions\IPSDefs\20090910.003\IDSXpx86.sys [11/09/2009 07:33 276344]
                  R2 AASW2_Service;Ashampoo AntiSpyWare 2 Service;c:\program files\Ashampoo\Ashampoo AntiSpyWare 2\AntiSpyWareService.exe [14/09/2009 18:59 749912]
                  R2 BcmSqlStartupSvc;Service de démarrage SQL Server pour le Gestionnaire de contacts professionnels;c:\program files\Microsoft Small Business\Business Contact Manager\BcmSqlStartupSvc.exe [16/01/2008 09:46 30312]
                  R2 Lavasoft Ad-Aware Service;Lavasoft Ad-Aware Service;c:\program files\Lavasoft\Ad-Aware\AAWService.exe [18/01/2009 23:34 1029456]
                  R2 Norton Internet Security;Norton Internet Security;c:\program files\Norton Internet Security\Engine\16.7.2.11\ccSvcHst.exe [09/09/2009 00:17 117640]
                  R2 WinDefend;Windows Defender;c:\program files\Windows Defender\MsMpEng.exe [03/11/2006 19:19 13592]
                  R3 A4501A;802.11g Wireless USB Adapter Driver;c:\windows\system32\drivers\A4501A.sys [13/03/2009 12:25 357408]
                  R3 EraserUtilRebootDrv;EraserUtilRebootDrv;c:\program files\Fichiers communs\Symantec Shared\EENGINE\EraserUtilRebootDrv.sys [29/08/2009 10:00 102448]
                  S3 MSSQL$MSSMLBIZ;SQL Server (MSSMLBIZ);c:\program files\Microsoft SQL Server\MSSQL.1\MSSQL\Binn\sqlservr.exe [24/11/2008 23:31 29263712]
                  S3 P1171VID;Creative WebCam Notebook #2;c:\windows\system32\drivers\P1171Vid.sys [09/02/2009 20:13 91392]
                  S3 qcusbser;Mobile Connector USB Device for Legacy Serial Communication;c:\windows\system32\drivers\cmusbser.sys [14/11/2008 16:40 97408]
                  S3 ZDCndis5;ZDCndis5 Protocol Driver;\??\c:\windows\system32\ZDCndis5.SYS --> c:\windows\system32\ZDCndis5.SYS [?]

                  --- Autres Services/Pilotes en mémoire ---

                  *Deregistered* - mchInjDrv

                  [HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\>{60B49E34-C7CC-11D0-8953-00A0C90347FF}]
                  "c:\windows\system32\rundll32.exe" "c:\windows\system32\iedkcs32.dll",BrandIEActiveSetup SIGNUP
                  .
                  Contenu du dossier 'Tâches planifiées'

                  2009-09-14 c:\windows\Tasks\Ad-Aware Update (Weekly).job
                  - c:\program files\Lavasoft\Ad-Aware\Ad-AwareAdmin.exe [2009-01-18 18:49]

                  2009-09-09 c:\windows\Tasks\AppleSoftwareUpdate.job
                  - c:\program files\Apple Software Update\SoftwareUpdate.exe [2008-07-30 12:34]

                  2009-09-15 c:\windows\Tasks\MP Scheduled Scan.job
                  - c:\program files\Windows Defender\MpCmdRun.exe [2006-11-03 17:20]

                  2009-09-15 c:\windows\Tasks\User_Feed_Synchronization-{C018398D-4AC6-4472-8374-9063B928C213}.job
                  - c:\windows\system32\msfeedssync.exe [2008-05-13 03:31]
                  .
                  .
                  ------- Examen supplémentaire -------
                  .
                  uStart Page = hxxp://home.live.com/
                  uInternet Settings,ProxyOverride = <local>;*.local
                  IE: Ajouter au fichier PDF existant - c:\program files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
                  IE: Convertir en Adobe PDF - c:\program files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
                  IE: Convertir la cible du lien en Adobe PDF - c:\program files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
                  IE: Convertir la cible du lien en un fichier PDF existant - c:\program files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
                  IE: Convertir la sélection en Adobe PDF - c:\program files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
                  IE: Convertir la sélection en un fichier PDF existant - c:\program files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
                  IE: Convertir les liens sélectionnés en fichier Adobe PDF - c:\program files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIECaptureSelLinks.html
                  IE: Convertir les liens sélectionnés en un fichier PDF existant - c:\program files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIEAppendSelLinks.html
                  IE: E&xporter vers Microsoft Excel - c:\progra~1\MICROS~3\Office12\EXCEL.EXE/3000
                  TCP: {04705497-0624-4D07-94E9-927BEF887EF9} = 212.217.0.1,212.217.0.12
                  DPF: {084DAC27-6FA3-4F55-9005-033F2F102F5C} - hxxp://data.jeuxclassiques.com/npwwg.cab
                  DPF: {7530BFB8-7293-4D34-9923-61A11451AFC5} - hxxp://download.eset.com/special/eos/OnlineScanner.cab
                  .
                  - - - - ORPHELINS SUPPRIMES - - - -

                  HKLM-Run-PRISMSVR.EXE - c:\program files\NOBRAND\802.11g
                  HKLM-Run-WService - WService.EXE
                  Notify-d444d054669 - c:\windows\System32\ds16gt32.dll
                  AddRemove-Creative PD1171 - c:\windows\CtDrvIns.exe -uninstall -script Pd1171.uns -unsext NT -plugin P1171Pin.dll
                  AddRemove-HijackThis - c:\genproc\outil\HijackThis.exe
                  AddRemove-{29943E04-5E17-416A-9876-41EE64BF88E9}}[Files]_is1 - c:\program files\Packard Bell\Driver CD Creator\unins000.exe

                  **************************************************************************

                  catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
                  Rootkit scan 2009-09-15 17:56
                  Windows 5.1.2600 Service Pack 3 NTFS

                  Recherche de processus cachés ...

                  Recherche d'éléments en démarrage automatique cachés ...

                  Recherche de fichiers cachés ...

                  c:\windows\TEMP\TMP00000010061A663AD088AA17 524288 bytes executable

                  Scan terminé avec succès
                  Fichiers cachés: 1

                  **************************************************************************

                  [HKEY_LOCAL_MACHINE\System\ControlSet001\Services\Norton Internet Security]
                  "ImagePath"="\"c:\program files\Norton Internet Security\Engine\16.7.2.11\ccSvcHst.exe\" /s \"Norton Internet Security\" /m \"c:\program files\Norton Internet Security\Engine\16.7.2.11\diMaster.dll\" /prefetch:1"
                  .
                  --------------------- DLLs chargées dans les processus actifs ---------------------

                  - - - - - - - > 'winlogon.exe'(1464)
                  c:\program files\Ashampoo\Ashampoo AntiSpyWare 2\Guard.dll

                  - - - - - - - > 'lsass.exe'(1520)
                  c:\program files\Ashampoo\Ashampoo AntiSpyWare 2\Guard.dll

                  - - - - - - - > 'explorer.exe'(3116)
                  c:\program files\Ashampoo\Ashampoo AntiSpyWare 2\Guard.dll
                  c:\windows\system32\eappprxy.dll
                  c:\windows\system32\webcheck.dll
                  c:\windows\system32\WPDShServiceObj.dll
                  c:\windows\system32\PortableDeviceTypes.dll
                  c:\windows\system32\PortableDeviceApi.dll

                  - - - - - - - > 'csrss.exe'(1440)
                  c:\program files\Ashampoo\Ashampoo AntiSpyWare 2\Guard.dll
                  .
                  ------------------------ Autres processus actifs ------------------------
                  .
                  c:\program files\Bonjour\mDNSResponder.exe
                  c:\program files\Java\jre6\bin\jqs.exe
                  c:\program files\Fichiers communs\Nero\Nero BackItUp 4\NBService.exe
                  c:\windows\system32\nvsvc32.exe
                  c:\program files\Microsoft SQL Server\90\Shared\sqlbrowser.exe
                  c:\program files\Microsoft SQL Server\90\Shared\sqlwriter.exe
                  c:\windows\system32\drivers\WTSrv.exe
                  c:\windows\system32\wbem\unsecapp.exe
                  c:\windows\system32\wbem\wmiapsrv.exe
                  c:\program files\Fichiers communs\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe
                  c:\program files\NOBRAND\802.11g Wireless USB Adapter\PRISMSVR.exe
                  .
                  **************************************************************************
                  .
                  Heure de fin: 2009-09-15 18:00 - La machine a redémarré
                  ComboFix-quarantined-files.txt 2009-09-15 16:00

                  Avant-CF: 15 280 189 440 octets libres
                  Après-CF: 19 529 547 776 octets libres

                  WindowsXP-KB310994-SP2-Pro-BootDisk-FRA.exe
                  [boot loader]
                  timeout=2
                  default=multi(0)disk(0)rdisk(0)partition(1)\WINDOWS
                  [operating systems]
                  c:\cmdcons\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons
                  multi(0)disk(0)rdisk(0)partition(1)\WINDOWS="Microsoft Windows XP Professionnel" /noexecute=optin /fastdetect

                  264 --- E O F --- 2009-09-10 19:37
                  0
                  1. Narco!4 Contributeur
                    ou en sont tes soucies?
                    0
                    1. caledolove
                      apparament je ne vois plus la fenêtre ADVANCED VIRUS REMOVED on verra si c'est bon. merci beaucoup de ton aide.
                      0
                      1. Narco!4 Contributeur
                        donne des news demain ;)
                        0
                        1. caledolove
                          Bon ecoute toute à l'air de bien fonctionné plus de fenêtre "advanced vieus removed" et mon internet explorer à retrouver se vitesse d'atant . Je te remerci beaucoup pour ce nettoyage. dis moi j'avais installer "Ashampoo Antispyware 2 Guard" , Ad Aware et Windows Defender. Est ce que j'ai vraiment besoin de c'est trois logiciel pour la suite ne plus choper ses cvirus ou vers, ou bien je les supprimes ? Encore une mille fois merci !!
                          0
                          1. Narco!4 Contributeur
                            c'est quoi ton av?
                            pare-feu?
                            0
                            • 1
                            • 2

                            Discussions similaires

                            Softonic,est-ce un virus ?
                            techmel1

                            6 réponses
                            Chrome://newtab
                            Nova

                            14 réponses
                            Désinstaller Softonic
                            Diguimette

                            5 réponses
                            Supprimer New Tab
                            tysaozon

                            8 réponses
                            Virus dans filezilla
                            balnelius10

                            9 réponses